Simplex 5-button combination locks (*Hobbit*'s in-depth evaluation) 


This deals with the Simplex or Unican 5-button all-mechanical combination locks. 
They are usually used in a variety of secure but 

high-traffic applications, and come in a number of flavors: dead bolt, slam 
latch, lock switches for alarms, buttons in a circle or a vertical 

line, etc. The internal locking works are the same across all of these. Herein 
will be described the mechanical workings and a method of 

defeating the lock that falls out by logical inference and observations from 
playing with it. 


The internals 


Caveat: If this seems unclear at first, it is because the absolutely best way to 
understand the inner mysteries is to take a Simplex lock 

apart and study it. It is highly recommended that the reader obtain and 
disassemble one of the units while studying this; otherwise the 

following may be confusing. The locking mechanism box is swaged together at each 
end, but it is trivial to open up without destroying 

it. To set a lock up for study, remove the back, leaving the front plate held on 
by its Jesus clip. Put a spare thumb turn down over the 

shaft so you have something to grab. Take care not to lose the button connecting 
pins; they drop out. 


In the round configuration, the buttons talk via bent bars in the faceplate to 
the same vertical column as the straight ones. Thus all 

buttons henceforth shall be referred to as if they were in a straight vertical 
row, numbered 1 to 5 reading downward. The actual locking 

mechanism inside is a small metal box, about 3 inches high and .75 x .75 inch 
across the base. It contains five tumblers, one 

corresponding to each button, a common shift bar, and a couple of cams to handle 
reset and unlocking. The user dials the combination 

and turns the handle to the right to open the lock, or to the left to reset any 
dialed digits if he made a typo. If the proper combination 

has not been dialed yet, the shaft will not turn to the right. Setting a 
combination shall be described later. Some of the linear-style locks 

are actually made by Unican, but have the Simplex box inside. For these, a 
clockwise twist serves as both open and reset. There is a 

detent plate and a screwy lever system; if the lock is not open yet, the lever 
cannot turn to the *box*'s right. The detent slips, allows the 

levers to shift the other way, and the box arm is then turned to the left. If 
the detent does not slip, it's open, and the plate locks to the 

latch shaft and pulls it back. 


Each of the five tumblers has six possible positions. Each button does nothing 
but push its corresponding tumbler from the © position to 

the 1 position. Therefore, each button can only be used once, since once the 
tumbler has moved, the button has no further effect. The 

trick comes when *subsequent* buttons are pushed. Each button press not only 
shoves its tumbler from 0 to 1, it also advances any 

"enabled" tumblers one more step. When a tumbler is enabled, its corresponding 
gear has engaged the common bar and pushed it 

around one position, so the next button press will do this again, thus taking 
previously enabled tumblers around one more notch. This 

way, the further-in tumbler positions can be reached. It can be seen that there 
are undialable combinations; for instance, only *one* 

tumbler can reach position 5 for a valid combination [Positions labeled © thru 


5, totalling six]. If one sits down and figures out possible 

places for the tumblers to go, many combinations are eliminated right away, so 
the number of possibilities is *not* 645 as one might 

expect. Two-at-once pushes are also valid, and are *not* the same as pushing the 
given two in some other order. Pushing two [or three 

or ...] at once simply enables two tumblers at once and shoves them to position 
1 at the same time. [This of course leaves less buttons 

unused to push them in farther!] The tumblers themselves are small round chunks 
of metal, with gear teeth around the top half and a 

notch cut into the bottom edge. When all these notches line up with the locking 
bar, the lock is open. The tumblers are mounted ona 

vertical shaft so they can spin, with the locking bar fingers resting against 
the bottom of each one. The locking bar is prevented from 

rising if any notch is turned away from it. Juxtaposed to the tumblers is 
another shaft containing idler gears, which in turn talk to the 

common bar in the back. The intermediate shaft slides up and down and makes 
combination changes possible. Note: The buttons 

actually talk to the idler gears and not the tumblers themselves. This is 
necessary since during a combo change, the tumblers cannot 

move because the locking bar teeth are sitting in the notches. 


[Editor's note: Simplex locks are set at the factory with a default code of (2- 
4), 3. This is often not even changed. ] 


Combination change, other random facts 


Once you know the current combination, you might want to change it. Instructions 
for doing this undoubtedly come with the lock; but 

it's real easy. There is a screw in the top with a hex hole; remove this from 
the lock body. Dial the proper combination, but don't move 

the handle. Press straight down through the hole with a small screwdriver, until 
you feel something go "thunk" downward. The lock is 

now in change mode. Reset the tumblers [leftward twist], enter your new 
combination, twist the handle as though opening the lock, 

and your change is now in effect. Re-insert the screw. This does the following: 
The thing you hit with the screwdriver pushes the 

tumblers down onto the locking bar [which is why the proper combination must be 
entered], and disengages them from their idler 

gears. Button presses turn the *idler* *gears* around, and then the opening 
action shoves the tumblers back up to mesh with these 

gears in their new positions. A subsequent reset mixes the tumblers up again to 
follow the new combination. This description is 

admittedly somewhat inadequate; the right thing to do is take one of the locks 
apart and see for one's self what exactly happens inside. 


The Unican model has a disk-locked screw on the rear side. Removing this reveals 
a round piece with a flat side. Twist this clockwise to 

enable change mode as in the above. This lock, of course, would be a little more 
secure against random people changing the 

combination for fun since you ostensibly need a key to get at it. Keep in mind 
that "reset" on these is done by turning the knob all the 

way *clockwise* instead. There is a linkage that ensures that the shaft inside 
goes counterclockwise for the time that change mode is 

enabled. 


It is amusing to hear local locksmiths call the Simplex internals a "computer". 
It would seem that none of them have taken one apart 


to see what is really inside; the box is painted black as far as they are 
concerned and non-openable. Obtaining one is the unquestionably 

best way to learn what's in there. Unfortunately they cost on the order of $120, 
a price which clearly takes advantage of the public's 

ignorance. These locks are *not* pick-proof after all, and anyone who maintains 
that they are is defrauding the customer. There are a 

variety of ways to increase the picking difficulty, to be discussed elsewhere. 
Your best bet is to borrow one from somewhere for an 

evening and spend the time learning its innards. 


Determining an unknown combination 


Contrary to what the marketing reps would have you believe, the locks can be 
opened fairly quickly without knowing the set 

combination and without damaging the lock. Through a blend of a soft touch, a 
little hard logic, and an implicit understanding of how 

the locking mechanism works, they generally yield within five minutes or so. 
[There are *always* exceptions... ] 


This method requires that one does not think in terms of a sequence of button 
presses. One must think in terms of tumbler positions, 

and simply use the buttons to place tumblers where desired. For practical 
description purposes, it will be assumed that the buttons 

connect right to the tumblers, rather than the idler gears that they really do. 
The idler gears are a necessary part only during 

combination changes. Unless you are doing a change, considering it this way is 
pretty close to the facts. Remember that a © position 

means the button was never pushed, and 5 is enabled and shifted as far as 
possible. 


Turning the thumb handle to the right [clockwise] raises the locking bar against 
the tumblers. Since the lock is never machined 

perfectly, one or more tumblers will have more pressure on it than other ones, 
and this shows up as friction against it when it is turned 

via the button. This friction is felt in the short distance between fully- 
extended and the detent on the button [the first 2 or 3 mm of 

travel]. Some will travel easily to the detent, and others will resist efforts 
to push them in. Suppose you are twisting the handle, and 

tumbler 1 has lots of pressure on it [you can feel this when you try to push 
button 1 in]. When you back off the tension on the handle a 

little bit, the button can be pushed in against the resistance. The fact that 
the button has resistance at position © tells you that tumbler 1's 

proper position is *not* 0, or there would be no pressure if the notch was 
there! Upon pushing button 1 in, you find that no pressure 

has appeared at any other button. This eliminates position 1 for tumbler 1, 
also. Now, how do you get tumbler 1 to different positions so 

you can test for pressure against other ones? Push subsequent buttons. Push any 
other button, and tumbler 1 advances to position 2. 

Ignore what the other tumblers are doing for the moment. Now, perhaps another 
button has some resistance now. This means that 

tumbler 1 is either at the right position, or getting close. Basically you are 
using other tumblers to find out things about the one in 

question. [Keep in mind that the first one with friction won't *always* be 
tumbler 1! Any tumbler[s] could have the first pressure on 

them. ] Continuing, push another "don't care" button. A "don't care" button is 
one that is not the one you're trying to evaluate, and not 

the one that recently showed some friction. What you want to do is advance 


tumbler 1 again without disturbing anything else. Did the 

pressure against your test tumbler get stronger, or disappear? If it got 
stronger, that points to an even higher probability that tumbler 1 is 

supposed to be at 3, rather than 2. If the pressure vanished or became less, 1 
has gone too far, and you were safer with it at position 2. 

Let's assume that the pressure against your test tumbler increased slightly when 
tumbler 1 was at 2, increased even more when tumbler 

1 was at 3 and vanished when you pushed it onward to 4. Reset the lock. You now 
know the proper position of tumbler 1 [that is, 

whatever tumbler first had pressure on it]. You've already drastically reduced 
the number of possible combinations, but you aren't 

finished yet. 


You can now eliminate positions for the next one or two tumblers the same way -- 
but to set things up so you can feel the pressure 

against these, you must ensure that your newly-known tumbler [1 in this case] is 
in its proper position. It is useful to make a little chart 

of the tumbler positions, and indicate the probabilities of correct positions. 


